critical9.8
CVE-2023-53955
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden s…
Impact
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sound4 | Stream Extension | Version 2.4.29 |
| Sound4 | Wm2 Firmware | Version 1.11 |
| Sound4 | Big Voice2 Firmware | Version 1.30 |
| Sound4 | Big Voice4 Firmware | Version 1.2 |
| Sound4 | Pulse Eco Firmware | Version 1.16 |
| Sound4 | Impact Eco Firmware | Version 1.16 |
| Sound4 | First Firmware | Versions 1.69, 2.15 |
| Sound4 | Pulse Firmware | Versions 1.69, 2.15 |
| Sound4 | Impact Firmware | Versions 1.69, 2.15 |
Weakness classification
References
- NVD record
- CVE.org record
- https://web.archive.org/web/20221207074555/https://www.sound4.com/
- https://www.exploit-db.com/exploits/51169
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-authorization-bypass-via-insecure-object-references
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php